File tree 3 files changed +19
-0
lines changed
3 files changed +19
-0
lines changed Original file line number Diff line number Diff line change @@ -402,6 +402,10 @@ SESSION_LIFE_TIME = 86400
402
402
403
403
[picture]
404
404
AVATAR_UPLOAD_PATH = data/avatars
405
+ ; Max Width and Height of uploaded avatars. This is to limit the amount of RAM
406
+ ; used when resizing the image.
407
+ AVATAR_MAX_WIDTH = 4096
408
+ AVATAR_MAX_HEIGHT = 3072
405
409
; Chinese users can choose "duoshuo"
406
410
; or a custom avatar source, like: http://cn.gravatar.com/avatar/
407
411
GRAVATAR_SOURCE = gravatar
Original file line number Diff line number Diff line change @@ -433,6 +433,17 @@ func (u *User) IsPasswordSet() bool {
433
433
// UploadAvatar saves custom avatar for user.
434
434
// FIXME: split uploads to different subdirs in case we have massive users.
435
435
func (u * User ) UploadAvatar (data []byte ) error {
436
+ imgCfg , _ , err := image .DecodeConfig (bytes .NewReader (data ))
437
+ if err != nil {
438
+ return fmt .Errorf ("DecodeConfig: %v" , err )
439
+ }
440
+ if imgCfg .Width > setting .AvatarMaxWidth {
441
+ return fmt .Errorf ("Image width is to large: %d > %d" , imgCfg .Width , setting .AvatarMaxWidth )
442
+ }
443
+ if imgCfg .Height > setting .AvatarMaxHeight {
444
+ return fmt .Errorf ("Image height is to large: %d > %d" , imgCfg .Height , setting .AvatarMaxHeight )
445
+ }
446
+
436
447
img , _ , err := image .Decode (bytes .NewReader (data ))
437
448
if err != nil {
438
449
return fmt .Errorf ("Decode: %v" , err )
Original file line number Diff line number Diff line change @@ -341,6 +341,8 @@ var (
341
341
342
342
// Picture settings
343
343
AvatarUploadPath string
344
+ AvatarMaxWidth int
345
+ AvatarMaxHeight int
344
346
GravatarSource string
345
347
GravatarSourceURL * url.URL
346
348
DisableGravatar bool
@@ -1024,6 +1026,8 @@ func NewContext() {
1024
1026
if ! filepath .IsAbs (AvatarUploadPath ) {
1025
1027
AvatarUploadPath = path .Join (AppWorkPath , AvatarUploadPath )
1026
1028
}
1029
+ AvatarMaxWidth = sec .Key ("AVATAR_MAX_WIDTH" ).MustInt (4096 )
1030
+ AvatarMaxHeight = sec .Key ("AVATAR_MAX_HEIGHT" ).MustInt (3072 )
1027
1031
switch source := sec .Key ("GRAVATAR_SOURCE" ).MustString ("gravatar" ); source {
1028
1032
case "duoshuo" :
1029
1033
GravatarSource = "http://gravatar.duoshuo.com/avatar/"
You can’t perform that action at this time.
0 commit comments